King Jackzebra

1. The attacker creates a Unity `6000.3.7f1` asset bundle containing a `Map` prefab. 2. The prefab contains the required `MapHiderSpawn` and `MapSeekerRoomAnchor` markers so that it passes the game's map validation. 3. The attacker adds a `PlayableDirector` with `playOnAwake = true`. 4. Its Timeline contains a `SignalEmitter` at time zero. The signal is marked retroactive and configured to emit once. 5. A `SignalReceiver` maps that signal to a serialized `UnityEvent`. 6. The event registers a static persistent listener for `Application.OpenURL(string)` with an attacker-controlled string argument. The harmless PoC uses `file:///C:/Windows/System32/calc.exe`. 7. The attacker publishes the map to Steam Workshop, hosts a lobby, and selects the map. 8. `NetworkRoomState.ServerSetWorkshopMap` replicates the map ID, name, and hash to connected clients. 9. When map preparation begins, `NetworkRoomState.OnPreparingMapChanged` calls `FetchMissingMap`, which calls `SteamWorkshopService.SubscribeAndDownloadAsync`. The client therefore retrieves the selected workshop item without a separate security prompt. 10. `WorkshopMapLoader.LoadRoutine` locates a `*.bundle`, checks its MD5 against the host's value, loads it with `AssetBundle.LoadFromFileAsync`, and instantiates the `Map` prefab. 11. The MD5 check establishes only that the client and host have the same file. It does not establish that the file is safe. 12. Instantiation activates the Timeline. `SignalReceiver.OnNotify` invokes the serialized `UnityEvent`, which resolves and calls `Application.OpenURL` with the supplied URI. 13. On Windows, the `file://` URI launches the selected executable through shell handling. In the PoC, the visible result is Calculator opening in the logged-in user's context.